Unless otherwise indicated herein, the materials described in this section are not prior art to the claims in this application and are not admitted to be prior art by inclusion in this section.
Traditional Operating Systems (OSes) may operate under several privilege levels, which for some implementation, are also referred to as ring levels. Among these ring levels, protected programs, such as parts of the kernel, usually operate at the highest privilege level (ring 0), and unprotected programs, such as user level applications, usually operate at a lower privilege level (e.g., ring 3). The ring-based privilege model may shield the protected programs from the unprotected programs. However, assigning all the protected programs into the same ring level is a monolithic protection model. As such, such operating environments may still be vulnerable to attacks from malwares (virus/rootkits) that are able to gain the higher privilege levels. Once a malware is elevated to the higher privilege level (e.g., ring 0), it may have the ability to intercept and alter system information, and may remove all traces of its existence, thereby preventing the detection of the malware. As such, malwares such as rootkits may be difficult to detect. In certain cases, even if detected, remediation or removal of these malwares may be difficult. The exposure is further magnified in the context of virtualization with multiple virtual machines, where compromise in one virtual machine may put the other virtual machines at risk.